Reported by 28 outlets

Timeline

1. original reporting

   CVE-2026-21589 (CRITICAL, CVSS 9.3) in Atlassian Bamboo Data Center https:// radar.offseq.com/threat/cve-20 26-21589-path-traversal-arbitrar

   radar.offseq.com · 8d ago · October 6th, 2026

   CVE-2026-21589 (CRITICAL, CVSS 9.3) in Atlassian Bamboo Data Center https:// radar.offseq.com/threat/cve-20 26-21589-path-traversal-arbitrar

   via Mastodon https://radar.offseq.com/threat/cve-2026-21589-path-traversal-arbitrary-readwrite-in-atlassian-bamboo-data-center-24a2d0e4e6de8f44

2. update from confluence.atlassian.com

   Happy morning... # critical # CVE in all # Atlassian products. https:// confluence.atlassian.com/secur ity/cve-2026-21589-arbitrary-file-acc

   confluence.atlassian.com · 7d ago · October 6th, 2026

   Happy morning... # critical # CVE in all # Atlassian products. https:// confluence.atlassian.com/secur ity/cve-2026-21589-arbitrary-file-acc

   via Mastodon https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html

3. update from gbhackers.com

   Atlassian CVE-2026-21589 Flaw Exposes Files in Jira and Confluence Data Center

   gbhackers.com · 7d ago · October 6th, 2026

   Atlassian has announced a critical vulnerability related to arbitrary file access that affects Jira Software Data Center and Confluence Data Center. This vulnerability, tracked as CVE-2026-21589, has a CVSS score of 9.3 and allows unauthenticated attackers to access specific files within the web root directories of the affected applications without needing valid credentials or accounts. […] The post Atlassian CVE-2026-21589 Flaw Exposes Files in Jira and Confluence Data Center appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. mentioned by thehackernews.com

   🤖 CVE-2026-21589 (CVSS 9.3): unauthenticated file read in 8 self-hosted Atlassian Data Center products (Bitbucket, Confluence, Jira...). Att

   thehackernews.com · 7d ago · October 6th, 2026

5. update from thehackernews.com

   A serious security flaw in several Atlassian products could allow unauthorized people to access sensitive files. If your business uses these

   thehackernews.com · 7d ago · October 6th, 2026

   A serious security flaw in several Atlassian products could allow unauthorized people to access sensitive files. If your business uses these

   via Mastodon https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html

6. update from malware.news

   Atlassian security advisory (AV26-1002)

   malware.news · 7d ago · October 6th, 2026

   Serial number: AV26-1002 Date: October 5, 2026 As of October 5, 2026, Atlassian is affected by a vulnerability in the following products: Bamboo Data Center Version 10.2.4 and prior Version 12.1.12 and prior Bamboo Server All versions Bitbucket Data Center Version 10.2.8 and prior Version 10.5.1 and prior Version 9.4.26 and prior Bitbucket Server All versions Confluence Data Center Version 10.2.19 and prior Version 9.2.26 and prior Confluence Server All versions Crowd Data Center Version 6.3.7 and prior Version 7.0.3 and prior Version 7.1.1 and prior Version 7.2.4 and prior Crowd Server All versions Crucible Data Center Version 4.9.15 and prior Crucible Server Version 4.9.15 and prior Fisheye Data Center Version 4.9.15 and prior Fisheye Server Version 4.9.15 and prior Jira Service Management Data Center Version 10.3.26 and prior Version 11.3.12 and prior Version 5.12.40 and prior Jira Service Management Server Version 5.12.40 and prior Jira Software Data Center Version 10.3.26 and prior Version 11.3.12 and prior Version 9.12.40 and prior Jira Software Server Version 9.12.40 and prior The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as

7. update from socprime.com

   CVE-2026-21589: Critical Atlassian Vulnerability Exposes Sensitive Files Across Eight Products

   socprime.com · 7d ago · October 6th, 2026

   The vulnerability highlights the growing risks associated with enterprise collaboration and development platforms, which often store sensitive business information and support critical organizational workflows. On October 5, 2026, Atlassian released an emergency security advisory urging customers to immediately patch affected installations or restrict external access until appropriate protections are implemented. As organizations face an expanding attack surface and increasingly sophisticated exploitation techniques, proactive vulnerability management and threat detection remain essential for minimizing exposure. Security teams can leverage SOC Prime’s AI-Native Detection Intelligence Platform to strengthen cyber defenses and accelerate detection engineering against emerging threats. The platform provides access to a continuously updated collection of detection content compatible with 40+ SIEM, EDR, and Data Lake technologies. Additionally, Uncoder AI enables security professionals to generate detection rules from threat intelligence, refine and validate detection logic, convert IOCs into hunting queries, and transl

8. update from labs.watchtowr.com

   You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) - watchTowr Labs

   labs.watchtowr.com · 7d ago · October 6th, 2026

   submitted by /u/dx7r__ [link] [comments]

   via reddit r/cybersecurity: You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) - watchTowr Labs

9. mentioned by labs.watchtowr.com

   New. WatchTower: You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-2158

   labs.watchtowr.com · 7d ago · October 6th, 2026

10. update from ifin.network

    Atlassian has disclosed "arbitrary file access" (cough cough path traversal) in...basically everything. Patches available, but so now is a b

    ifin.network · 7d ago · October 6th, 2026

    Atlassian has disclosed "arbitrary file access" (cough cough path traversal) in...basically everything. Patches available, but so now is a b

    via Mastodon https://ifin.network/t/cve-2026-21589-arbitrary-file-access-in-multiple-atlassian-products/885

11. update from bleepingcomputer.com

    Atlassian warns of critical file-access flaw in Jira, Confluence

    bleepingcomputer.com · 7d ago · October 6th, 2026

    However, exploitation requires knowing the exact name of the file and path. “Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents,” Atlassian says. CVE-2026-21589 affects all product versions released before the releases listed below, which address the vulnerability: Atlassian urges system administrators who manage self-hosted instances to apply the security updates immediately. Cloud customers need to take no action, as the vendor has automatically patched the products. If immediate patching is not possible, the company recommends restricting external network access, including for internet-facing instances that require user authentication. Temporary mitigations include adding a web application firewall (WAF) or proxy rule blocking specified traversal patterns across all affected products, Tomcat RewriteValve rules for Confl

12. update from www.theregister.com

    Reward: You've received a bronze Patch It Yesterday Medallion. It was supposed to be gold, but that version required authentication. https:/

    www.theregister.com · 7d ago · October 6th, 2026

    Reward: You've received a bronze Patch It Yesterday Medallion. It was supposed to be gold, but that version required authentication. https:/

    via Mastodon https://www.theregister.com/security/2026/10/06/atlassian-warns-of-critical-file-access-flaw-in-its-datacenter-products/5301284

13. mentioned by www.bleepingcomputer.com

    🤖 CVE-2026-21589: critical arbitrary file-access flaw in self-hosted Atlassian Data Center products (Confluence, Jira, Bitbucket). Atlassian

    www.bleepingcomputer.com · 7d ago · October 6th, 2026

14. update from labs.watchtowr.com

    @ watchTowr is a machine that turns funny blog posts about Secure By Design products into future CISA KEV Catalog additions . This time it's

    labs.watchtowr.com · 7d ago · October 6th, 2026

    @ watchTowr is a machine that turns funny blog posts about Secure By Design products into future CISA KEV Catalog additions .

15. mentioned by labs.watchtowr.com

    Oopsies: https:// labs.watchtowr.com/you-wont-he ar-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-rea

    labs.watchtowr.com · 7d ago · October 6th, 2026

16. mentioned by www.bleepingcomputer.com

    CVE-2026-21589 (critical): unauthenticated arbitrary file access in self-hosted Atlassian Data Center — Jira, Confluence, Bitbucket, Bamboo.

    www.bleepingcomputer.com · 7d ago · October 7th, 2026

17. update from www.infoworld.com

    CVE-2026-21589 (critical): unauthenticated arbitrary file access in self-hosted Atlassian Data Center — Jira, Confluence, Bitbucket, Bamboo. A critical Atlassian flaw affects eight enterprise products at once — a reminder of the attack surface of an integrated ecosystem.

    www.infoworld.com · 7d ago · October 7th, 2026

    A critical Atlassian flaw affects eight enterprise products at once — a reminder of the attack surface of an integrated ecosystem. via Mastodon https://www.infoworld.com/article/4231553/atlassians-critical-flaw-turns-eight-enterprise-products-into-one-big-security-problem-3.html

18. mentioned by cyberwald.com

    Cyberwald Cybersecurity News - 07.10.2026 Today in the podcast: Critical Atlassian vulnerability CVE-2026-21589 in 8 Data Center products.

    cyberwald.com · 6d ago · October 7th, 2026

19. update from securityweek.com

    Atlassian Patches Critical Vulnerability Affecting 8 Products

    securityweek.com · 6d ago · October 7th, 2026

    In some configurations, there may be sensitive files present that increase your risk,” Atlassian notes in its advisory . Organizations are advised to patch their self-hosted deployments as soon as possible or disconnect their instances from the internet until the fixes can be installed. Atlassian’s advisory also details temporary mitigations. “Instances accessible to

20. update from rapid7.com

    CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

    rapid7.com · 6d ago · October 7th, 2026

    Atlassian assigned the vulnerability a CVSSv4 score of 9.3 . Atlassian's advisory treats all versions before the applicable fixed releases as affected, including unsupported versions. Detailed technical analysis and file-read proof-of-concept scripts are public, so Rapid7 recommends patching on an emergency basis, outside of normal patch cycles, and reviewing access logs for attempted exploitation. Technical overview NVD lists files or directories accessible to external parties ( CWE-552 ) as the weakness associated with CVE-2026-21589. On October 6, watchTowr Labs published a technical analysis based on comparisons of vulnerable and patched Jira, Confluence, and Bitbucket packages. Their analysis identified a path traversal vulnerability in Atlassian's web-resource handling: double-colon ( :: ) sequences can become path separators during reque

21. update from bleepingcomputer.com

    Hackers exploit critical Atlassian flaw after public PoC release

    bleepingcomputer.com · 6d ago · October 7th, 2026

    Earlier today, security company Previdian detected the activity on its honeypot network, just hours after a detailed technical report was published. The issue is an arbitrary file-access flaw disclosed on Monday, and it affects self-hosted instances of eight Atlassian products: In a security advisory on Monday, Atlassian warned system administrators managing self-hosted instances to apply the security updates as soon as possible, noting it cannot determine whether individual customer instances have been compromised. Atlassian Crowd provides centralized identity management, single sign-on (SSO), authentication, authorization, and access management for connected Data Center apps. The researchers exploited the root cause of the flaw, which is a shared web-resource library that converts double colons "::" into forward slashes "/", to construct directory-traversal requests t

22. update from malware.news

    Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)

    malware.news · 6d ago · October 7th, 2026

    An attacker can read arbitrary files in the web application’s directory, potentially exposing sensitive information such as configuration files. Article Link: Scans for Atlassian vulnerablity (CVE-2026-21589) - SANS ISC

23. update from cyberworldops.eu

    Unauthenticated arbitrary file access in eight self-hosted Atlassian families (CVE-2026-21589) is seeing active probing after public PoC rel

    cyberworldops.eu · 6d ago · October 7th, 2026

    Unauthenticated arbitrary file access in eight self-hosted Atlassian families (CVE-2026-21589) is seeing active probing after public PoC rel

    via Mastodon https://cyberworldops.eu/en/public-exploit-code-triggers-rapid-probing-of-eight-atlassian-product

24. mentioned by threataft.com

    🚨 CVE-2026-21589 — Atlassian Data Center, CVSS 9.3, exploited in the wild Unauthenticated path traversal in atlassian-plugins-webresource. A

    threataft.com · 6d ago · October 7th, 2026

25. mentioned by www.bleepingcomputer.com

    # Atlassian warns of critical file-access flaw in # Jira , # Confluence https://www. bleepingcomputer.com/news/secu rity/atlassian-warns-of-

    www.bleepingcomputer.com · 6d ago · October 7th, 2026

26. mentioned by censys.com

    🚨 Rapid Response: CVE-2026-21589 (CVSS 9.3) is a critical arbitrary file access vulnerability affecting eight Atlassian Data Center products

    censys.com · 6d ago · October 7th, 2026

27. update from www.yazoul.net

    🔹 THREAT INTELLIGENCE Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details Vulnerability | HIGH A criti

    www.yazoul.net · 6d ago · October 7th, 2026

    🔹 THREAT INTELLIGENCE Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details Vulnerability | HIGH A criti

    via Mastodon https://www.yazoul.net/news/article/atlassian-data-center-flaw-draws-exploitation-attempts-within-two-hours-of-publi

28. update from cyberwald.com

    🎙️ Cyberwald - Cybersecurity-News - 08.10.2026 Today in the podcast: • ccTLD hijack: Google certificates over .gh, .sl, .as • FBI-

    cyberwald.com · 5d ago · October 8th, 2026

    🎙️ Cyberwald - Cybersecurity-News - 08.10.2026 Today in the podcast: • ccTLD hijack: Google certificates fraudulently obtained over .gh, .sl, and .as • FBI-

    via Mastodon https://cyberwald.com/podcast/2026-10-08.podcast.ogg

29. mentioned by www.secpoint.com

    Critical Atlassian Data Center vulnerability CVE-2026-21589 Atlassian has disclosed CVE-2026-21589, a critical unauthenticated arbitrary fil

    www.secpoint.com · 5d ago · October 8th, 2026

30. mentioned by www.it-connect.fr

    Atlassian critical file-read flaw CVE-2026-21589 in Jira/Confluence/Bitbucket

    www.it-connect.fr · 5d ago · October 8th, 2026

31. mentioned by diesec.com

    Atlassian CVE-2026-21589 (CVSS 9.3): unauthenticated file read in 8 Data Center products incl. Jira, Confluence, Bitbucket, Crowd. No exploi

    diesec.com · 5d ago · October 8th, 2026

32. mentioned by threatnoir.com

    ⚠️ CRITICAL: Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details A critical arbitrary file access vuln

    threatnoir.com · 5d ago · October 8th, 2026

33. update from www.bleepingcomputer.com

    Atlassian CVE-2026-21589 exploitation requires file path; Crowd properties exposure enables admin creation

    www.bleepingcomputer.com · 5d ago · October 8th, 2026

    On Jira+Crowd, read WEB-INF/classes/crowd.properties; with those credentials an administrator account is created.

34. mentioned by beyondmachines.net

    Atlassian Patches Critical File Access Flaw Exploited in the Wild Atlassian released emergency patches for a critical arbitrary file access

    beyondmachines.net · 5d ago · October 8th, 2026

35. mentioned by thehackernews.com

    Atlassian Data Center flaw CVE-2026-21589 draws exploitation attempts within two hours of public details

    thehackernews.com · 5d ago · October 8th, 2026

36. update from securityweek.com

    Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication

    securityweek.com · 5d ago · October 8th, 2026

    The attacks began shortly after technical details went public. WatchTowr used those credentials to create a new user and add it to the Jira administrators group. As of Octobe

37. mentioned by www.bleepingcomputer.com

    Hackers exploit critical # Atlassian flaw after public PoC release https://www. bleepingcomputer.com/news/secu rity/hackers-exploit-critical

    www.bleepingcomputer.com · 5d ago · October 8th, 2026

38. mentioned by cybersecurefox.com

    Atlassian critical vulnerability CVE-2026-21589: file reading without login 🔗 https:// cybersecurefox.com/en/critical -atlassian-vulnerabili

    cybersecurefox.com · 5d ago · October 8th, 2026

39. mentioned by linuxmint.hu

    CVE-2026-21589: critical arbitrary file access flaw affects multiple Atlassian Data Center products (Jira, Confluence, Bitbucket)

    linuxmint.hu · 5d ago · October 8th, 2026

40. mentioned by confluence.atlassian.com

    Atlassian says CVE-2026-21589 affects all versions of eight self-hosted products. An unauthenticated attacker can read specific files when t

    confluence.atlassian.com · 5d ago · October 8th, 2026

41. mentioned by www.imperva.com

    (imperva.com) Critical Arbitrary File Access Vulnerability in Atlassian Data Center Products (CVE-2026-21589): Analysis and Mitigation In br

    www.imperva.com · 5d ago · October 9th, 2026

42. mentioned by cybersecurefox.com

    Atlassian Data Center critical vulnerability CVE-2026-21589 is already being exploited 🔗 https:// cybersecurefox.com/en/critical -vulnerabil

    cybersecurefox.com · 4d ago · October 9th, 2026

43. update from meterpreter.org

    Hackers rapidly exploit the Atlassian vulnerability CVE-2026-21589. Learn how this critical flaw compromises Jira, Confluence, and Bitbucket

    meterpreter.org · 4d ago · October 9th, 2026

    Learn how this critical flaw compromises Jira, Confluence, and Bitbucket

    via Mastodon https://meterpreter.org/atlassian-cve-2026-21589-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

44. mentioned by tp-security.com

    Today's brief: - Atlassian DC CVE-2026-21589 (CVSS 9.3): pre-auth file read, probed since Oct 6. Patch (e.g. Confluence 9.2.26/10.2.19); che

    tp-security.com · 4d ago · October 9th, 2026